Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
Malicious release: Malicious code in @velkov/isows (npm) MAL-2026-10524 | Malicious | Not scored | 14 Jul, 2026 | npm @velkov/isows |
Malicious release: Malicious code in @wrenfield/abitype (npm) GHSA-6f83-g2m3-3wwr, MAL-2026-10529 | Malicious | Not scored | 14 Jul, 2026 | npm @wrenfield/abitype |
Malicious release: Malicious code in @tabrex/bs58 (npm) MAL-2026-10523 | Malicious | Not scored | 14 Jul, 2026 | npm @tabrex/bs58 |
Malicious release: Malicious code in @vite-mcp/vite-type (npm) GHSA-mqf9-3wx8-45cj, MAL-2026-10525 | Malicious | Not scored | 14 Jul, 2026 | npm @vite-mcp/vite-type |
Malicious release: Malicious code in @vitets/vite-ts (npm) GHSA-733v-wc48-f65r, MAL-2026-10528 | Malicious | Not scored | 14 Jul, 2026 | npm @vitets/vite-ts |
Malicious release: Malicious code in @vite-ts/vite-ui (npm) GHSA-jm6h-xxm2-2mr3, MAL-2026-10527 | Malicious | Not scored | 14 Jul, 2026 | npm @vite-ts/vite-ui |
Malicious release: Malicious code in @vite-pro/vite-ui (npm) GHSA-phpx-wpr2-26pv, MAL-2026-10526 | Malicious | Not scored | 14 Jul, 2026 | npm @vite-pro/vite-ui |
Malicious release: Malicious code in @amedit/vercel-builder-probe (npm) GHSA-wvc3-vq7q-w2mw, MAL-2026-10548 | Malicious | Not scored | 14 Jul, 2026 | npm @amedit/vercel-builder-probe |
Malicious release: Malicious code in flick-test-app (npm) GHSA-94ph-qqm7-h26r, MAL-2026-10522 | Malicious | Not scored | 14 Jul, 2026 | npm flick-test-app |
Malicious release: Malicious code in @flcik/flick.js (npm) GHSA-f5p8-w3hq-m27h, MAL-2026-10521 | Malicious | Not scored | 14 Jul, 2026 | npm @flcik/flick.js |
Malicious release: Malicious code in fastify-bundler (npm) GHSA-f99h-9jhg-jrxw, MAL-2026-10520 | Malicious | Not scored | 14 Jul, 2026 | npm fastify-bundler |
Malicious release: Malicious code in @tqm-mfe/main (npm) GHSA-cg4c-94r8-hqjq, MAL-2026-10517 | Malicious | Not scored | 14 Jul, 2026 | npm @tqm-mfe/main |
Malicious release: Malicious code in chai-as-sets (npm) MAL-2026-10519 | Malicious | Not scored | 14 Jul, 2026 | npm chai-as-sets |
Malicious release: Malicious code in chai-as-auth (npm) MAL-2026-10518 | Malicious | Not scored | 14 Jul, 2026 | npm chai-as-auth |
Malicious release: Malicious code in polymarket-bot-logger (npm) GHSA-v4pc-gmg8-h48w, MAL-2026-10516 | Malicious | Not scored | 13 Jul, 2026 | npm polymarket-bot-logger |
Malicious release: Malicious code in nodemon-client (npm) GHSA-cw3m-3cvq-pwp2, MAL-2026-10513 | Malicious | Not scored | 13 Jul, 2026 | npm nodemon-client |
Malicious release: Malicious code in nodemon-eslint (npm) GHSA-v57g-fjf5-426h, MAL-2026-10514 | Malicious | Not scored | 13 Jul, 2026 | npm nodemon-eslint |
Malicious release: Malicious code in nodemon-web (npm) GHSA-62c9-p25c-7xxm, MAL-2026-10515 | Malicious | Not scored | 13 Jul, 2026 | npm nodemon-web |
Malicious release: Malicious code in type-astr (npm) GHSA-q9rm-w335-55w5, MAL-2026-10510 | Malicious | Not scored | 13 Jul, 2026 | npm type-astr |
Malicious release: Malicious code in type-swap (npm) GHSA-w8hw-4vch-mrj4, MAL-2026-10511 | Malicious | Not scored | 13 Jul, 2026 | npm type-swap |
Malicious release: Malicious code in type-unique (npm) GHSA-h8x5-f48q-v2h7, MAL-2026-10512 | Malicious | Not scored | 13 Jul, 2026 | npm type-unique |
Malicious release: Malicious code in nodemon-delog (npm) GHSA-7gjf-8j8g-xm9p, MAL-2026-10507 | Malicious | Not scored | 13 Jul, 2026 | npm nodemon-delog |
Malicious release: Malicious code in nodemon-elint (npm) MAL-2026-10508 | Malicious | Not scored | 13 Jul, 2026 | npm nodemon-elint |
Malicious release: Malicious code in chai-as-verified (npm) MAL-2026-10504 | Malicious | Not scored | 13 Jul, 2026 | npm chai-as-verified |
Malicious release: Malicious code in node-fsagent (npm) GHSA-qgvj-fw22-j5v6, MAL-2026-10506 | Malicious | Not scored | 13 Jul, 2026 | npm node-fsagent |
Malicious release: Malicious code in test_adminet (npm) MAL-2026-10509 | Malicious | Not scored | 13 Jul, 2026 | npm test_adminet |
Malicious release: Malicious code in express-ini (npm) GHSA-w3p6-c3cm-r253, MAL-2026-10505 | Malicious | Not scored | 13 Jul, 2026 | npm express-ini |
Malicious release: Malicious code in filewisee (npm) GHSA-wp6h-28pg-v4j5, MAL-2026-10501 | Malicious | Not scored | 13 Jul, 2026 | npm filewisee |
Malicious release: Malicious code in bubblestring (npm) MAL-2026-10496 | Malicious | Not scored | 13 Jul, 2026 | npm bubblestring |
Malicious release: Malicious code in ddok-modal (npm) GHSA-5xvp-j6m9-rwr6, MAL-2026-10497 | Malicious | Not scored | 13 Jul, 2026 | npm ddok-modal |
Malicious release: Malicious code in n8n-nodes-rce-poc (npm) GHSA-f4f3-9g54-864m, MAL-2026-10503 | Malicious | Not scored | 13 Jul, 2026 | npm n8n-nodes-rce-poc |
Malicious release: Malicious code in gamified-trading-system (npm) GHSA-h8fc-h568-wwr9, GHSA-hh4c-9fqx-2vc5, MAL-2026-10502 | Malicious | Not scored | 13 Jul, 2026 | npm gamified-trading-system |
Malicious release: Malicious code in eslint-angular-react (npm) GHSA-jp3x-3mrw-3vwf, MAL-2026-10498 | Malicious | Not scored | 13 Jul, 2026 | npm eslint-angular-react |
Malicious release: Malicious code in express-bunker (npm) GHSA-mrw6-p6x7-7jj3, GHSA-w7r5-8cmj-m893, MAL-2026-10500, SNYK-JS-EXPRESSBUNKER-19161375 | Malicious | Not scored | 13 Jul, 2026 | npm express-bunker |
Malicious release: Malicious code in @quukk/opencode-clawmessenger (npm) MAL-2026-10495 | Malicious | Not scored | 13 Jul, 2026 | npm @quukk/opencode-clawmessenger |
Malicious release: Malicious code in @quickcall/krew (npm) MAL-2026-10494 | Malicious | Not scored | 13 Jul, 2026 | npm @quickcall/krew |
Malicious release: Malicious code in eth-lib-utils (npm) GHSA-q57p-j3v9-q767, MAL-2026-10499 | Malicious | Not scored | 13 Jul, 2026 | npm eth-lib-utils |
Malicious release: Malicious code in insomnia-plugin-poc-m4gester-run (npm) MAL-2026-10493 | Malicious | Not scored | 13 Jul, 2026 | npm insomnia-plugin-poc-m4gester-run |
Malicious release: Malicious code in assertcoreutils (npm) GHSA-22qr-5q9r-7v6x, MAL-2026-10491 | Malicious | Not scored | 13 Jul, 2026 | npm assertcoreutils |
Malicious release: Malicious code in font-huge (npm) GHSA-x8f8-q6m3-g4pq, MAL-2026-10492 | Malicious | Not scored | 13 Jul, 2026 | npm font-huge |
Malicious release: Malicious code in @sqlite-panel/createsql (npm) GHSA-mq68-3vc3-ch3q, MAL-2026-10490 | Malicious | Not scored | 13 Jul, 2026 | npm @sqlite-panel/createsql |
Malicious release: Malicious code in permcarmserver (npm) GHSA-9499-pgrg-v7w7, MAL-2026-10488 | Malicious | Not scored | 13 Jul, 2026 | npm permcarmserver |
Malicious release: Malicious code in permcserver (npm) GHSA-vjr2-cx8x-3q2x, MAL-2026-10489 | Malicious | Not scored | 13 Jul, 2026 | npm permcserver |
Malicious release: Malicious code in @omniwatch-wick/cli (npm) GHSA-x4cm-7r6h-pjg3, MAL-2026-10486 | Malicious | Not scored | 13 Jul, 2026 | npm @omniwatch-wick/cli |
Malicious release: Malicious code in @outsmartly/metaobjects (npm) MAL-2026-10487 | Malicious | Not scored | 13 Jul, 2026 | npm @outsmartly/metaobjects |
Malicious release: Malicious code in polymarket-stake-kelly-math-check (npm) GHSA-w387-g22r-3pw7, MAL-2026-10485 | Malicious | Not scored | 13 Jul, 2026 | npm polymarket-stake-kelly-math-check |
Malicious release: Malicious code in react-icons-svgo (npm) GHSA-m78v-9w6f-xwf2, MAL-2026-10482 | Malicious | Not scored | 13 Jul, 2026 | npm react-icons-svgo |
Malicious release: Malicious code in node-fsmetrics-data (npm) GHSA-85wr-m3c9-v62j, MAL-2026-10479 | Malicious | Not scored | 13 Jul, 2026 | npm node-fsmetrics-data |
Malicious release: Malicious code in route-processor (npm) GHSA-8mrq-4593-6x5p, MAL-2026-10483 | Malicious | Not scored | 13 Jul, 2026 | npm route-processor |
Malicious release: Malicious code in node-fsmetrics-native (npm) GHSA-hfgq-7j44-m23h, MAL-2026-10480 | Malicious | Not scored | 13 Jul, 2026 | npm node-fsmetrics-native |